@orkestrel/scaffold 0.0.72 → 0.0.74

package/dist/host/agents/skills/orkestrel-prove-journey/references/statechart.md

@@ -1,7 +1,29 @@
 # The statechart family
 
-Declare one transition table, and give it to the automated run that asserts it and to the
-harness a person watches. Never write a second table for the harness.
+Declare one transition table, and give it to the run that asserts it and to the harness a person
+watches. Never write a second table for the harness.
+
+## The vocabulary
+
+```ts
+import type { StateScenario, StateTransition, StatechartStatus } from '@orkestrel/test'
+import {
+	STATECHART_ATTRIBUTES,
+	STATECHART_STATUSES,
+	buildRefusal,
+	executeScenario,
+	executeScenarios,
+	requireValue,
+} from '@orkestrel/test'
+import type { HarnessInterface, HarnessOptions } from '@orkestrel/test/browser'
+import {
+	clickAccessible,
+	clickDisclosure,
+	createHarness,
+	readStates,
+	render,
+} from '@orkestrel/test/browser'
+```
 
 ## Declare the table
 
@@ -12,13 +34,134 @@ harness a person watches. Never write a second table for the harness.
   Design laws bars a literal union that names no real domain state.
 - Write one `StateScenario` per transition, carrying that `transition` plus `arrange`, `act`, and
   `assert`. Each phase receives the context and the part of the transition it owns.
-- Put the scenarios in the workspace's browser test setup module. Put the table beside them until a
-  harness page ships; from then on declare it in the application's own constants module, typed on the
-  entity's unions, and import it from the page and from the setup alike, because a page cannot
-  import from `tests/` and a second table is what this reference forbids.
+- Put the scenarios and the table in the workspace's browser test setup module, and import them from
+  there.
 - Declare a transition for every event the surface accepts in every state it accepts it, including
   the event that leaves the state unchanged. A table that lists only the moves the happy path takes
   proves the happy path.
+- Write the phases as module functions the whole table shares. Each phase reads its subject from its
+  own parameters rather than from the row it belongs to, so one set serves a table of any size.
+
+## The worked table
+
+Copy the shape of the following table, which is the table this layer's own browser suite runs. Its
+entity is a native disclosure with a second door: the summary toggles it, and a `Dismiss` button
+closes it and does nothing when it is already closed. Give your own table the same row that second
+door produces here — the row whose event leaves the state where it found it.
+
+```ts
+import type { StateScenario } from '@orkestrel/test'
+import { executeScenarios, requireValue } from '@orkestrel/test'
+import { clickAccessible, clickDisclosure, readStates, render } from '@orkestrel/test/browser'
+import { expect, it } from 'vitest'
+
+type DisclosureState = 'closed' | 'open'
+type DisclosureEvent = 'toggle' | 'dismiss'
+
+interface DisclosureContext {
+	readonly summary: HTMLElement
+}
+
+// A journey verb resolves its own target by accessible name, so a second mounted disclosure called
+// "Advanced" is an ambiguity rather than a second fixture. Each build takes the previous one out.
+let mounted: HTMLElement | undefined
+
+function buildDisclosure(): DisclosureContext {
+	mounted?.remove()
+	const container = render(
+		'<details><summary>Advanced</summary><p>Every setting.</p></details><button type="button">Dismiss</button>',
+	)
+	const details = requireValue(container.querySelector('details'))
+	requireValue(container.querySelector('button')).addEventListener('click', () => {
+		details.open = false
+	})
+	mounted = container
+	return { summary: requireValue(container.querySelector('summary')) }
+}
+
+function readDisclosure(context: DisclosureContext): DisclosureState {
+	return readStates(context.summary).includes('expanded') ? 'open' : 'closed'
+}
+
+async function arrangeDisclosure(
+	context: DisclosureContext,
+	state: DisclosureState,
+): Promise<void> {
+	if (readDisclosure(context) !== state) await clickDisclosure('Advanced')
+}
+
+// The context is unused because a journey verb finds what a person reads rather than a node this
+// row was handed.
+async function actOnDisclosure(_context: DisclosureContext, event: DisclosureEvent): Promise<void> {
+	if (event === 'toggle') await clickDisclosure('Advanced')
+	else await clickAccessible('Dismiss')
+}
+
+function assertDisclosure(context: DisclosureContext, state: DisclosureState): void {
+	expect(readDisclosure(context)).toBe(state)
+}
+
+const SCENARIOS: ReadonlyArray<StateScenario<DisclosureState, DisclosureEvent, DisclosureContext>> =
+	[
+		{
+			transition: {
+				name: 'closed opens through the summary',
+				from: 'closed',
+				event: 'toggle',
+				to: 'open',
+			},
+			arrange: arrangeDisclosure,
+			act: actOnDisclosure,
+			assert: assertDisclosure,
+		},
+		{
+			transition: {
+				name: 'open closes through the summary',
+				from: 'open',
+				event: 'toggle',
+				to: 'closed',
+			},
+			arrange: arrangeDisclosure,
+			act: actOnDisclosure,
+			assert: assertDisclosure,
+		},
+		{
+			transition: {
+				name: 'open closes through the button',
+				from: 'open',
+				event: 'dismiss',
+				to: 'closed',
+			},
+			arrange: arrangeDisclosure,
+			act: actOnDisclosure,
+			assert: assertDisclosure,
+		},
+		{
+			// The row whose event leaves the state where it found it.
+			transition: {
+				name: 'closed stays closed through the button',
+				from: 'closed',
+				event: 'dismiss',
+				to: 'closed',
+			},
+			arrange: arrangeDisclosure,
+			act: actOnDisclosure,
+			assert: assertDisclosure,
+		},
+	]
+
+it('walks the disclosure statechart', async () => {
+	await executeScenarios(SCENARIOS, buildDisclosure)
+})
+```
+
+- Name each row for the door it drove. A table that names only the states reads as if one mechanism
+  moved the entity, and the row where the button leaves the disclosure exactly as it found it is the
+  one a name has to separate from the toggle rows beside it.
+- Remove the previous fixture inside the builder. Without that removal the next row meets the
+  previous disclosure beside its own under one name, and the verb refuses them as ambiguous.
+- Drive a native `<summary>` with `clickDisclosure` and an ARIA disclosure with `clickAccessible`
+  settled by `waitForState` ([layer.md](layer.md) → Disclosures).
 
 ## Run the table
 
@@ -28,60 +171,123 @@ harness a person watches. Never write a second table for the harness.
 - Build the context in `build`, which receives the row it is building for. That is what lets one
   table mix fixtures.
 - Let the runner name the failure. It prepends the transition's `name` to whatever the row threw and
-  carries the original as the `cause`, so a bare assertion message still says which row failed.
+  carries the original as the `cause`, so a bare assertion message still says which row failed. A
+  phase that throws something other than an `Error` is named by its type, and a builder that refuses
+  raises `<name>: build refused` with its own refusal as the `cause`.
+  `buildRefusal(name, cause)` from `@orkestrel/test` builds that same error, so an assertion on
+  a refused build compares against what it returns rather than against a spelled string.
 - Never assert the entity's internal state in `assert` where the transition is one a person drives.
   Assert what the interface renders, through `readPerception`, `readValue`, or `readStates`.
 
 ## Drive the act the way the transition happens
 
 - Drive `act` through the journey verbs — `clickAccessible`, `clickDisclosure`, `typeAccessible`,
-  `traverseAccessible` — and through `userEvent.keyboard` from `vitest/browser` where the transition
-  is a key on an already-focused control, for every transition a person can cause.
+  `traverseAccessible`, `pressKeys` — for every transition a person can cause.
 - Drive `act` through the entity's own API only where the transition is the entity's rather than the
   person's: a lifecycle event, a transport reply, a timer the surface owns.
 - Say which door each row used, in the row's `name`. A table that mixes the doors silently reads as
   a set of user transitions and proves something else.
 
-## Build the harness a person watches
-
-Mount the harness on the same table. It stays in the repository that owns the surface: only
-`StateTransition`, `StateScenario`, `executeScenario`, `executeScenarios`, `STATECHART_ATTRIBUTES`,
-and `STATECHART_STATUSES` are published, and a workspace that spells a `data-statechart-*` string of
-its own has left the contract.
-
-- Render one play control per transition and one play-all control, each disabled while a run is in
-  flight.
-- Render a state badge carrying the entity's current state, an event log of what the entity emitted,
-  and a `role="status"` announcer that narrates each step in a sentence, so a screen reader and a
-  vision model both read the run without visual chrome.
-- Publish `STATECHART_ATTRIBUTES.status` on the harness root, and cycle its value through
-  `STATECHART_STATUSES`: `pending` before a run has a result for every row, `idle` standing ready,
-  `running` in flight, and `passed` or `failed` as the terminal reading. Publish
-  `STATECHART_ATTRIBUTES.passed`, `.failed`, and `.total` on the same element, so a gate finds the
-  harness and reads the tally from one node.
-- Publish `STATECHART_ATTRIBUTES.scenario` and `STATECHART_ATTRIBUTES.result` on each row, and
-  `STATECHART_ATTRIBUTES.state` on the element rendering the entity's current state.
-- Write every attribute from the map rather than from a literal. A harness that sets an attribute
-  the gate does not read fails silently as a run that never completes.
-- Deep-link one transition and the play-all run from the route, so a decision round names the exact
-  link it wants looked at ([decide.md](decide.md) → The rendered artifact).
-- Give the harness a demo step that leaves the widget in its most legible state after the run, for a
-  person or a vision model deciding on a look.
-- Pace the harness for a person to watch. The gate inherits that wall time, so budget the gate from
-  the row count and the pause rather than from a fixed timeout.
+## Mount the harness
+
+`createHarness(options)` renders the table in the browser and drives it row by row. It takes the
+table as `scenarios`, the fixture builder as `build`, the reader that reports the entity's state as
+`state`, and an optional `pause` between rows for a table worth watching.
+
+```ts
+import { STATECHART_ATTRIBUTES } from '@orkestrel/test'
+import { createHarness } from '@orkestrel/test/browser'
+
+const harness = createHarness({
+	scenarios: SCENARIOS,
+	build: buildDisclosure,
+	state: readDisclosure,
+})
+
+harness.status // 'idle' — mounted, nothing run yet
+harness.total // 4
+
+await harness.execute()
+
+harness.status // 'passed'
+harness.passed // 4
+harness.failed // 0
+harness.failures // []
+
+// The object reads its own markup, so a gate polling the page and a test asserting on the object
+// cannot disagree.
+harness.root.getAttribute(STATECHART_ATTRIBUTES.status) // 'passed'
+harness.root.getAttribute(STATECHART_ATTRIBUTES.total) // '4'
+
+harness.destroy()
+```
+
+- Hand it the same table the run asserts. A second table for the harness is what this reference
+  forbids.
+- Let it render its own markup. It writes `status`, `passed`, `failed`, and `total` on its root,
+  `scenario` and `result` on each row, and `state` on the element rendering the entity's current
+  state, every one of them from `STATECHART_ATTRIBUTES` rather than from a literal. A workspace that
+  spells a `data-statechart-*` string of its own has left the contract.
+- Read the announcer beside the attributes. A `role="status"` element narrates each step in a
+  sentence, so a screen reader and a vision model both read the run without visual chrome.
+- Take `execute` as reporting on the whole table. It carries on past a failing row, where
+  `executeScenarios` stops at the first, and a builder that refuses fails its own row under the
+  sentence `buildRefusal` builds rather than ending the run.
+- Call `execute` again to re-run the same table from a fresh tally and a cleared rendered state.
+- Call `destroy` in the test's own cleanup. It removes the mounted root and does nothing when the
+  root is already gone.
+- Pace a table a person watches with `pause`, and budget the gate from the row count and that pause
+  rather than from a fixed timeout.
+
+## The observable statuses
+
+`STATECHART_STATUSES` publishes the run states in the order a run passes through them, and
+`StatechartStatus` is the same set as a named union.
+
+| Status    | The reading it names                                                                     |
+| --------- | ---------------------------------------------------------------------------------------- |
+| `pending` | Construction, until every declared row has rendered and `total` carries the row count    |
+| `idle`    | Mounted and standing ready, with `passed` and `failed` at zero and nothing in flight     |
+| `running` | A run in flight                                                                          |
+| `passed`  | Terminal: the run finished and no row's result reads failed                              |
+| `failed`  | Terminal: the run finished with a failing row, or it ended on the `state` reader's throw |
+
+- Read a `pending` status as a harness whose rows never mounted. A gate that finds it has found a
+  defect rather than a run to wait for.
+- Read `total` as what the table declares and `passed` plus `failed` as what the last run finished.
+- Take the terminal pair as the pair a gate waits for. Every exit writes one of them: a run the
+  `state` reader ends writes `failed` and then rejects with that reader's value by identity, and the
+  row that reader was called for is not counted as failed.
+- Read the state element as carrying no reading before the first row produces a context. A state is
+  read from an entity, and no entity exists until a row builds one.
 
 ## Gate the harness
 
-Prove the harness from the browser project, through the interface:
-
-- Mount the harness page and clear the route's query first, so a leftover deep link cannot start the
-  walk before the gate does.
-- Press the play-all control through `clickAccessible`, never through a constructed event and never
-  by setting the deep link.
-- Poll `STATECHART_ATTRIBUTES.status` until it reads `passed` or `failed`. Never assert it from one
-  read after the click.
-- Assert the status reads `passed`, the failed tally reads zero, and the passed tally equals the
-  total. Name the failing rows from `STATECHART_ATTRIBUTES.scenario` in the failure message, so a red
-  gate says which transition broke.
-- Assert the harness inventory before the rows: a page that mounted no transition passes every tally
-  assertion.
+Prove the harness from the browser project, through the object and the markup together:
+
+- Mount the harness, `execute` it, and assert the status reads `passed`, the failed tally reads
+  zero, and the passed tally equals the total.
+- Assert the inventory before the tally. A harness that mounted no row would pass every tally
+  assertion, and `createHarness` refuses an empty table with `Statechart harness mounted no
+transition`.
+- Name the failing rows from `failures`, which lists each row whose rendered `result` reads failed,
+  in table order. A red gate says which transition broke.
+- Read the tally off `harness.root` as well as off the object, so the attribute contract a gate
+  outside the page depends on is asserted rather than assumed.
+- Poll the root's `status` attribute until it reads a terminal value where the gate runs outside
+  this layer's environment, under a budget derived from the row count and the declared pause. Never
+  assert it from one read after the start.
+
+## A harness page is product
+
+A deep-linked page hosting a harness is optional product the workspace ships on its own account.
+This layer's browser entry imports `vitest/browser` at module scope, so an application page cannot
+import it.
+
+- Name only the attribute contract such a page must honour: the names in `STATECHART_ATTRIBUTES`,
+  the readings in `STATECHART_STATUSES`, and the tally on one root node.
+- Report the page itself as the repository owner's decision — which transitions a surface owes,
+  where the page is linked, and whether it ships at all.
+- Route a person who must watch the widget move to the harness run's own frames and its written
+  artifact ([decide.md](decide.md) → The harness run), and name a deep link only where the workspace
+  already ships such a page.

package/dist/host/agents/skills/orkestrel-prove-journey/references/styles.md

@@ -2,37 +2,93 @@
 
 Prove a style from what the browser resolved on the mounted surface. The `enterprise-bootstrap`
 skill's [instruments reference](../../enterprise-bootstrap/references/inspection.md) names each
-instrument's property, its population, and the negative controls that must fail. Take those from
-there and the reading from here.
+instrument's property, its population, and its coverage. Take those from there, the reading from
+here, and the control from the builder this layer publishes for it.
+
+## The vocabulary
+
+```ts
+import type {
+	CaptureVariant,
+	CensusFixture,
+	CensusReading,
+	Color,
+	ContrastFixture,
+	EscapeFixture,
+} from '@orkestrel/test/browser'
+import {
+	CANVAS_COLOR,
+	blendColor,
+	buildCensus,
+	buildContrast,
+	buildEscapes,
+	extractOrphans,
+	extractStyles,
+	findKeyframes,
+	findRule,
+	matchesColor,
+	measureContrast,
+	measureLuminance,
+	parseCSSColor,
+	pressKeys,
+	readBackdrop,
+	readCascade,
+	readCensus,
+	readClasses,
+	readContrast,
+	readLayers,
+	readPixels,
+	readRing,
+	readRootToken,
+	readRows,
+	readStyle,
+	readToken,
+	traverseAccessible,
+	waitForAnimations,
+} from '@orkestrel/test/browser'
+import { inject } from 'vitest'
+```
 
 ## Assert the resolved value
 
 - Read one property with `readStyle(element, property)` and a length with `readPixels(element, property)`. A
   class present in the markup and absent from the cascade resolves to nothing, and an assertion on
   the class list passes on it.
+- Read `readPixels` as a measured contribution rather than a parsed length. A resolved value
+  carrying no leading number reads as `0`, so read the text with `readStyle` where an unparsable
+  value and a genuine zero are different findings.
 - Never substitute `findRule` for a resolved read. It proves a declaration exists, and another rule
-  may still win; reach for it where the stylesheet itself is the subject.
+  may still win; reach for it where the stylesheet itself is the subject, and for `findKeyframes`
+  where the animation's declaration is.
 - Compare a color through `matchesColor` or `parseCSSColor` rather than by string. A browser normalizes a color
   expression, so a literal comparison fails on a value that resolved correctly.
+- Take every reading after the paint settles. Await `waitForAnimations` on the element whose
+  transition was running ([layer.md](layer.md) → The waits); a reading taken mid-transition reports
+  an interpolated frame no state of the interface paints.
 
 ## Run per variant
 
 The run axis is fixed in [SKILL.md](../SKILL.md) → Read the variant once. The matrix family's own
 readings follow.
 
-- Apply each variant's `apply` and its `width` and `height` before the readings, and take every
-  reading for that variant before moving to the next.
+- Read `inject('variants')` for the declared list, and walk every entry inside one run. This family
+  reads the whole matrix, where the capture family renders one variant per run.
+- Compose each variant's `apply` in the test, and apply it with the variant's `width` and `height`
+  before the readings. Take every reading for that variant before moving to the next.
 - Name the attribute the surface actually reads in `apply`; a Bootstrap surface switches on
   `data-bs-theme`. An `apply` that sets another attribute leaves the run in the default theme, where
   every reading passes.
+- Reach for the application's own theme control where the surface ships one, and assert the state it
+  announces. Setting the attribute directly proves the stylesheet; driving the control proves the
+  surface.
 - Assert that the run read every declared variant. A matrix that silently walked one variant reports
   a pass for the theme nobody exercised.
 - Report which variants a result covers beside it. A pairing that appears only in a state the run
   never entered is unmeasured.
 
-Vitest `provide` carries serializable values only. Where a workspace fans one project out per
-variant, the project's provided variant carries `name`, `width`, and `height`; `apply` does not
-cross that channel. Run `apply` inside the test from the variant the project provides.
+Vitest `provide` carries serializable values only, so the provided variant carries `name`, `width`,
+and `height`; `apply` does not cross that channel. Compose it in the test from the name the project
+provided.
 
 ## Contrast and focus chrome
 
@@ -43,39 +99,62 @@ cross that channel. Run `apply` inside the test from the variant the project pro
   are all translucent; take that refusal as the reading, because an assumed white canvas turns "this
   surface declares no background" into a number that reads like a measurement.
 - Read focus chrome with `readRing(control)`, after focus arrived through `traverseAccessible`,
-  `userEvent.keyboard` from `vitest/browser`, or a real click. Pass `worn` where the chrome is painted onto a second element such
+  `pressKeys`, or a real click. Pass `worn` where the chrome is painted onto a second element such
   as a label. It reports `undefined` for a control not matching `:focus-visible`, for the browser's
   own automatic ring, and for a focus style that only repaints the fill — treat each as a finding
   about the surface rather than as a pass.
-- Carry the negative controls the composited-contrast instrument names, in the same run and composed
-  in the harness rather than taken from the surface. An instrument whose negative control passes is
-  broken, and its readings are not evidence.
 - Reach for `measureContrast`, `measureLuminance`, `blendColor`, `readLayers`, and `readBackdrop`
   only where the composite itself is the subject. Never re-derive `readContrast` from them.
 
+## The published controls
+
+Take each reading's control from the builder this layer publishes for it.
+`.claude/rules/quality.md` § Instruments owns the law that control satisfies.
+
+| Reading         | Control                   | What it carries                                                                        |
+| --------------- | ------------------------- | -------------------------------------------------------------------------------------- |
+| `readContrast`  | `buildContrast(bar)`      | A translucent tint over an opaque floor, with a `refused` and an `accepted` foreground |
+| `extractStyles` | `buildEscapes(permitted)` | An inline declaration, an embedded `<style>` element, and the sheet the id exempts     |
+| `readCensus`    | `buildCensus()`           | An HTML token and an SVG token, neither declared by any loaded stylesheet              |
+
+- Append each control's `root` to the same surface root the reading walks, take the reading, and
+  remove it afterwards. Every builder returns detached nodes and mounts nothing, so where the
+  control is read is the caller's decision.
+- Assert on the fields the builder returns rather than on a token or a selector written down in the
+  test. `buildCensus` hands back its own tokens, and `buildContrast` hands back `refused` and
+  `accepted` by name.
+- Require the `refused` foreground to read under the bar and the `accepted` one to reach it, in the
+  same run as the production readings. `buildContrast` refuses a bar its own stack cannot straddle,
+  and that refusal is the reading: no pair it can compose settles that bar.
+- Pass the exempt id the policy owns to `buildEscapes`, so the reader must leave the permitted sheet
+  alone rather than passing by rejecting every `<style>` element.
+
 ## The authored-class census
 
-Take the property, the population, and the negative controls from the instruments reference →
-Authored class in the shipped cascade. This is the reading.
+Take the property, the population, and the coverage from the instruments reference → Authored class
+in the shipped cascade. This is the reading.
 
-- Read the census as the difference between `readClasses(root)` of the mounted surface and
-  `readCascade()`. A token in the difference is a class the markup uses and no loaded stylesheet
-  declares.
+- Read the census with `readCensus(root)`, which walks the mounted surface, reports `elements` as
+  the population it read, lists every `tokens` value the markup carries, and lists as `undeclared`
+  the tokens no loaded stylesheet declares. It refuses a walk that read no element.
+- Assert on `elements` as well as on `undeclared`. An empty walk reports no undeclared token, and so
+  does markup whose every class the cascade declares.
 - Take `root` from the mounted surface, so the census covers what rendered rather than what a
   template file spells.
-- Report what `readClasses` walked as the population, and fail a run that walked none.
-- Append the extraction-door negative control to that same `root`, so it reaches the difference
-  through `readClasses` rather than beside it.
+- Read `readClasses` and `readCascade` directly only where one side of the difference is the
+  subject. `readCensus` is the reading, and re-deriving it drops the population it reports.
+- Append `buildCensus().root` to that same `root`, so the control reaches the difference through the
+  same walk rather than beside it.
 
 ## Style escapes
 
-Take the property, the population, the named exemptions, and the negative control from the
-instruments reference → Style escapes. This is the reading.
+Take the property, the population, the named exemptions, and the coverage from the instruments
+reference → Style escapes. This is the reading.
 
 - Read escapes with `extractStyles(root)`, which returns the markup of every hit it found.
 - Take the reading before any journey drives the surface, because the population is the undriven
   tree.
-- Append the harness-built negative control element to that same `root`, so it reaches the reading
+- Append `buildEscapes(permitted).root` to that same `root`, so the control reaches the reading
   through `extractStyles`.
 - Reach for `extractOrphans` where the finding is a child element rendered outside its required
   parent, and `readRows` where the subject is a repeated row's rendered text.
@@ -89,3 +168,12 @@ instruments reference → Style escapes. This is the reading.
   assertion on presence passes on a token nobody declared.
 - Read each token once per variant and assert the values differ where the design says the variants
   differ. A pair of variants that resolves a token identically is a theme that did not switch.
+
+## The engine bound
+
+Every reading here comes from the one engine the gate renders.
+
+- State that bound with the result. A claim about another engine's resolved value is unproven until
+  a reading taken on that engine records it.
+- Read the limit and the condition that reopens it from the emitted `configs/browsers.ts` doc block,
+  which the generated workspace ships, rather than from a copy in the suite.

package/dist/host/agents/transports/codex.md

@@ -128,6 +128,13 @@ The Orchestrator verifies the finished exec with direct evidence — git status,
 scoped validation — and carries touched files, diffstat, and deviation state into
 integration and review.
 
+On a Windows host a shell write that decodes and re-encodes text can replace a code point the active
+code page cannot represent, so when a bench unit must edit a line carrying a code point above
+`0x7F`, the brief tells it to make that edit through the exec's own patch tool, never through
+`Get-Content`, `Set-Content`, `Out-File`, or a `>` redirection, and to report every such line it
+touched. The Orchestrator's review sweep compares the set of code points above `0x7F` on each
+touched line before and after the edit, and flags a line that lost any of them.
+
 ## Routing exclusion — defensive negative-test units
 
 The provider applies a content-safety filter that terminates a turn mid-run when the work